yashsingh1/xdaforums huggingface dataset:
[Nexus 7 (2013) Q&A] 459below:
I want to share my data. So I had been running one of those dreadful Kingston eMMCs, specifically KE4CN4K6 16GB, until the N7 crashed and refused to boot. I managed to get into TWRP and run a fsck on the encrypted userdata partition, since hope springs eternal. After a staggering amount of I/O errors, the system still refused to boot with the addition of TWRP joining in. However TWRP still booted far enough for ADB to be available, hence enabling me to analyse the eMMC. My eMMC seems to behave slightly different than other broken eMMCs from what I gather. First of all it seems to show up as intended like this:

new HS200 MMC card at address 0001
mmcblk0: mmc0:0001 MMC16G 14.4 GiB

However any kind of manipulation of the block device and its partitions (like fastboot erase/format, dd, mkfs, mount) would just hang. Qualcomm HS-USB Diagnostics 9006 (or 9008 - I'm not certain) did expose the MMC mass storage device, which would be responding with I/O errors on access.

I'm set to swap the eMMC with a Samsung Hynix 64 GB 4.5 eMMC, like KLMCG8GEAC-B001 H26M78003BFR. If I going to do this, I might as well try to upgrade. I plan to use a cheap USB-eMMC dongle, like the ones mentioned earlier, to initially flash the bootloader. Unless however I could gather some information about connecting the 20-pin ARM-JTAG interface of the N7. Since those pins are really tiny I am entirely certain I won't be capable to connect those by soldering. So I hope there is some kind of connector which fits on those pins. Would anyone be able to provide information on this?
[Nexus 7 (2013) Q&A] SMARTJUAN:
Hello, sorry for my English, again I address this thread, as I see that there are people interested in changing memory chip EMMC, I'm still looking for ways to change the chip, what steps to follow to install the system or if there is install Bootloader before welding on new chip, I have plates to test and access to several Emmc chips, grateful for any information about it, greetings and thanks.
[Nexus 7 (2013) Q&A] k23m:
It is possible to flash in-circuit a blank, new, bricked or corrupt eMMC with QPST, MiFlash (yes - it works on ASUS devices too) or ASUS FlashTool and service ROM in Qualcomm HS-USB Diagnostics 9008 mode. I can see ME571KL service ROMs here but they need to be re-uploaded to a more accessible server. Also, these look interesting.
[Nexus 7 (2013) Q&A] SMARTJUAN:
Thank you very much, it would be the pump if we could expand storage memory with a memory of 64Gb you think it would be possible, I will see the way to falsify memory with Miflash, I have a friend who dominates that topic, I will report progress, greetings.
[Nexus 7 (2013) Q&A] Dazmatic:
I unfortunately no longer have my Nexus 7. After replacing the motherboard with a 16gb version, I found out that the tablet wasn't going to be of use to me (replace a cube T7) and so sold it. I've still got the emmc USB adapter though should anyone be interested?
[Nexus 7 (2013) Q&A] 459below:
I am relieved to learn, that in-circuit flashing is possible after all. I was confused by the "not yet" bit in the first post:

Unfortunately I was not able to download any of the service roms, which have been referred to. My replacement eMMC has not yet arrived, thus I cannot proceed right away. Although I did order a reballing stencil and several USB-eMMC adapters, I will solder the new eMMC directly to the N7 motherboard and attempt to use QSPT to initialize the eMMC. It is my current understanding, that the central issue is to persuade the N7 to switch from the initial Qualcomm HS-USB QDLoader-state into a mode in which it will expose the eMMC as mass storage device. In this situation one should be able to restore the GPT and copy back the actual file systems. I reckon the Github project Unbricking_Tools by PL125 would proof rather helpful in this endeavour.
[Nexus 7 (2013) Q&A] k23m:
This will not work with a blank, new chip, because the driver of mass storage mode - Diagnostics 9006, resides on SBL1 partition of eMMC, so it must be flashed there in the first place! You may enter the 9006 mode in your broken Kingston but it is useless with bad chips.

As for the "not yet" bit, it depends on the availability of a service ROM and, as you have noticed, it is not yet easily available. I think a baidu.com account must be created before a download is possible. A search for...

ME571KL_epad_eng_800M_10_10_0_51_1_16_Rawdata.rar

and

ME571KL-OPEN_epad-eng-800M-xhdpi-hdpi-D00_1.15.F_0610-10.10.0.51.1.19-20131230-1921-Rawdata.rar

...reveals also other Chinese download sites. Note, while ME571KL is for the 'deb' N7, the service ROM will also work with ME571K or 'flo', wifi-only N7.

:good:
[Nexus 7 (2013) Q&A] davefiddes:
I have been able to download them OK. The Great Firewall Of China suffers from a lot of congestion issues but I seemed to get a good time of day.

To help people experiment I have uploaded the two engineering roms to my website. Unfortunately because I've not posted enough I can't put up links :(. PM me if you'd like the links.

The files have been edited to remove the Linux kernel and system partition to keep the download size reasonable. It should be possible to substitute the appropriate files from the Google images with little difficulty. The details of the files I removed are:

[dave@snowman ME571KL-OPEN_epad-eng-800M-xhdpi-hdpi-D00_1.15.F_0610-10.10.0.51.1.16-20130823-1356-Rawdata]$ ls -l vmlinux system.img
-rw-r--r-- 1 dave dave 639918780 Aug 23 2013 system.img
-rw-r--r-- 1 dave dave 171519783 Aug 23 2013 vmlinux
[dave@snowman ME571KL-OPEN_epad-eng-800M-xhdpi-hdpi-D00_1.15.F_0610-10.10.0.51.1.19-20131230-1921-Rawdata]$ ls -l vmlinux system.img
-rw-r--r-- 1 dave dave 639931080 Dec 30 2013 system.img
-rw-r--r-- 1 dave dave 171520855 Dec 30 2013 vmlinux

I'll have a look at using them myself in due course. I'm working up the energy to have another go at resoldering my new Toshiba THGBMFG8C4LBAIR flash chip. After cleaning my first attempt doesn't look to have the right alignment and I don't want to power on my Nexus 7 until I check it very carefully. I wouldn't recommend the USB adapter approach as they seem to be quite fragile (and/or my BGA reworks skills too low). My USB adapter reported it was an SD card reader when new and unpopulated (as expected), after trying to solder a new flash chip on it didn't show up at all and desoldering and reflowing hasn't restored it. I may have fried my flash chip in the process too. I wish others greater success!
[Nexus 7 (2013) Q&A] k23m:
Fantastic news :victory:, thanks in advance! :highfive: Yes, system.img etc. are not necessary, essentially we need only:

8064_msimage.mbn
MPRG8064.hex
partition.xml
rawprogram0.xml
patch0.xml

Hopefully the USB adapter method will not be needed anymore since in-circuit programming should now work!
[Nexus 7 (2013) Q&A] 459below:
That's what I suspected. I reckon, that the important files (like .HEX) in the service rom package have been signed by a Qualcomm key.

I did find that to be false. There is a certain Java based downloader out there, which helps with baidu.com downloads. My eMMC is presumably going to arrive some time next week. I'm set to solder it right away onto the N7 and subsequently flash it with the elusive service rom.
[Nexus 7 (2013) Q&A] k23m:
Nexus 7 2013 Unbricking Guide

Instructions for soft-bricked or blank/replaced eMMC. If your tablet can boot in fastboot mode, you do not need it.

Download these files

:

Nexus 7 2013 Service ROM

MiFlash-20141107

"razor" Nexus 7 [2013] (Wi-Fi) 6.0.1 (MOB30X) factory image (flo), or...

"razorg" Nexus 7 [2013] (Mobile) 6.0.1 (MOB30X) factory image (deb)

latest Google USB Driver

latest ADB and Fastboot Binaries (optional)

Next...

unpack the service ROM

install MiFlash/MiPhone

turn on and connect N7 to PC

new USB\VID_05C6&PID_9008 "Qualcomm HS-USB Diagnostics 9008" device will be registered

if no driver is found, point it to "C:\Program Files\Xiaomi\MiPhone\Qualcomm\Driver"

run MiFlash

click Refresh, note a new device on a high COM port number, eg. I see COM20

click Browse and go to the service ROM folder with 28 files

click Flash (see attachments)

when flashing is finished (ignore error messages), power N7 off

boot it in fastboot mode (power+vol-)

if necessary for fastboot, install Google USB Driver

from the service ROM folder check for: fastboot devices

run "debrick-flashall.cmd" (ignore error messages)

if it was a blank eMMC, do this extra step using: fastboot boot twrp.img

flash factory image - instructions

run Android MOB30X once, then you can flash TWRP and a custom ROM

2021 UPDATE:

- Nexus 7 2013 Unbricking Guide for Windows 10 x64 - revised and simplified

- Nexus 7 2013 Unbricking Guide for Linux and Mac OS X

.
[Nexus 7 (2013) Q&A] 459below:
[YOUTUBE]h07rEeYdh1I[/YOUTUBE]

I am preparing for the physical replacement of the eMMC. In this respect I am trying to understand the purpose of the step at 5:00. Is he somewhat reballing the pads on the logic board or is he just tidying up, in order to form a proper joint when he is actually soldering the eMMC onto the board?
[Nexus 7 (2013) Q&A] k23m:
He is cleaning up the pads after old chip removal and applying fresh flux. We do not re-ball PCB, only smooth it out. As the workflow is universal, it is better to watch a non-N7, better quality BGA rework video.

It looks like you are going to be the first to replace and unbrick your Kingston :highfive:

Cheers!
[Nexus 7 (2013) Q&A] davewpy:
It works. I can now get into bootloader.

Battery is too low right now probably due to discharge, hanging on in bootloader to let it charge.

I did a quick test to upload the factory image, but my system partition has invalid block - still need further investigation here.

Good news is that it certainly brings the device out of 9008 mode. Kudos to updating us here!
[Nexus 7 (2013) Q&A] davewpy:
I had to leave it charging in power off mode for a night on my pc - otherwise it was impossible to manage fastboot in low battery state.

As the partition table is corrupted, I had to use fastboot boot <kernel using twrp> to boot to recovery and push parted command and work from there manually in a Linux shell.

Will update again when I have the time to continue repartitioning in the shell.

---------- Post added at 02:17 PM ---------- Previous post was at 01:54 PM ----------

The partition tables are totally different now, will need to do more investigations.

~ # fdisk -l /dev/block/mmcblk0
Found valid GPT with protective MBR; using GPT

Disk /dev/block/mmcblk0: 61079552 sectors, 1152M
Logical sector size: 512
Disk identifier (GUID): 98101b32-bbe2-4bf2-a06e-2bb33d000c20
Partition table holds up to 8 entries
First usable sector is 34, last usable sector is 12673

Number Start (sector) End (sector) Size Code Name
1 34 233 100K 0700 SBL1
2 234 633 200K 0700 SBL2
3 634 1433 400K 0700 SBL3
4 1434 11673 5120K 0700 aboot
5 11674 12073 200K 0700 RPM
6 12074 12673 300K 0700 TZ
7 12674 12677 2048 0700 DDR
8 12678 12693 8192 0700 ssd

And the original:

Disk identifier (GUID): 98101b32-bbe2-4bf2-a06e-2bb33d000c20
Partition table holds up to 32 entries
First usable sector is 34, last usable sector is 61079518

Number Start (sector) End (sector) Size Code Name
1 131072 306143 85.4M 0700 radio
2 393216 399359 3072K 0700 modemst1
3 399360 405503 3072K 0700 modemst2
4 524288 554287 14.6M 0700 persist
5 655360 656919 780K 0700 m9kefs1
6 656920 658479 780K 0700 m9kefs2
7 786432 787991 780K 0700 m9kefs3
8 787992 794135 3072K 0700 fsg
9 917504 920503 1500K 0700 sbl1
10 920504 923503 1500K 0700 sbl2
11 923504 927599 2048K 0700 sbl3
12 927600 937839 5120K 0700 aboot
13 937840 938863 512K 0700 rpm
14 1048576 1081343 16.0M 0700 boot
15 1179648 1180671 512K 0700 tz
16 1180672 1180673 1024 0700 pad
17 1180674 1183673 1500K 0700 sbl2b
18 1183674 1187769 2048K 0700 sbl3b
19 1187770 1198009 5120K 0700 abootb
20 1198010 1199033 512K 0700 rpmb
21 1199034 1200057 512K 0700 tzb
22 1310720 3031039 840M 0700 system
23 3031040 4177919 560M 0700 cache
24 4194304 4196351 1024K 0700 misc
25 4325376 4345855 10.0M 0700 recovery
26 4456448 4456463 8192 0700 DDR
27 4456464 4456479 8192 0700 ssd
28 4456480 4456481 1024 0700 m9kefsc
29 4587520 4587583 32768 0700 metadata
30 4718592 61079518 26.8G 0700 userdata
[Nexus 7 (2013) Q&A] k23m:
The service ROM is intended for a new, blank chip initialization. Since you had bricked your device after partition table changes in the first place, the errors appear to still persist. Please boot TWRP and use either dd or sgdisk to zero-out partition table, which will brick it again but also simulate a blank eMMC condition. Then repeat the unbricking procedure. With dd you need to erase the first 5632 bytes, however a backup GPT is also stored at the end of eMMC and its address would need to be calculated, so I think it is better to use sgdisk:

sgdisk --zap-all /dev/block/mmcblk0

As sgdisk is not included in TWRP, I attached it for you. :highfive:
[Nexus 7 (2013) Q&A] davewpy:
Thank you very much for helping me to find out all these information.

Where did you get it from? I've been looking around whenever I can on Google but never got to the details like this.
[Nexus 7 (2013) Q&A] k23m:
Hold on, I've just realized that you had not done the "flashall.cmd" step!

fastboot flash partition gpt_both0.bin

It creates all 'deb' partitions - stop the zero-out, do flashall.cmd! Your IMEI should also survive.

ps

I found it on a Chinese site, but with a name like ME571KL-OPEN_epad-eng-800M-xhdpi-hdpi-D00_1.15.F_0610-10.10.0.51.1.19-20131230-1921-Rawdata it wasn't easy.
[Nexus 7 (2013) Q&A] davewpy:
I've already done that. It doesn't write properly.

Do you know how to get the IMEI back in?
[Nexus 7 (2013) Q&A] k23m:
I see, then go ahead with partition table zapping.

To backup 'deb' IMEI do:

dd if=/dev/block/mmcblk0p5 of=/tmp/bkp/m9kefs1.img
dd if=/dev/block/mmcblk0p6 of=/tmp/bkp/m9kefs2.img
dd if=/dev/block/mmcblk0p7 of=/tmp/bkp/m9kefs3.img

Unfortunately you had not done it before resizing system partitions.
[Nexus 7 (2013) Q&A] davewpy:
I did previously backed up mk9kefsc instead as it was part of the contiguous blocks that I will affect.

Am not sure what it does - but now, it seems like youtube does have some tools to help you recreate IMEI, which is available on the box of the tablet. *GOOD*

On the other hand, I was unable to push parted (32-bit ARM) and use it in TWRP, but unable to use "sgdisk" - kept telling me not found .

So right now i'm wondering if I should just manually remove all partitions, brick it, and repeat the earlier steps and see what's changed, or manually re-create the important partitions.
[Nexus 7 (2013) Q&A] k23m:
Please check corrections to the guide. Basically, instead of the script, run:

fastboot flash gpt gpt_both0.bin
fastboot flash bootloader bootloader.img
fastboot reboot-bootloader

Works for me - I just bricked and unbricked my tablet. Actually my Android (LOS 14.1) and data partitions have survived total GPT zapping and everything is running again, but on the ancient v3.12 bootloader. Instead of factory image flash I will only update the bootloader to v4.08
[Nexus 7 (2013) Q&A] davewpy:
fastboot flash partition changed to gpt and it works.

EDIT: Went ahead to flash-all. Looks good.

I used fastboot flash bootloader bootloader-deb-flo-04.08.img as thats the file from factory stock. Is this what you wanted?

---------- Post added at 09:59 PM ---------- Previous post was at 09:55 PM ----------

Android is booting right now.
[Nexus 7 (2013) Q&A] davewpy:
Nexus 7 successfully unbricked from 9008 mode!

IMEI, BT, WLAN all intact without doing anything. I will check out the partition tables, IMEI numbers later to see if its changed from original.
[Nexus 7 (2013) Q&A] k23m:
Yes, that's how I updated v3.12 to v4.08, except I use 'flo', so...

fastboot flash bootloader bootloader-flo-flo-04.08.img

I believe your IMEI has survived because the preflash/init partitions were located way below the IMEI location and have not overwritten anything important. Let us know...
[Nexus 7 (2013) Q&A] davewpy:
It could be that.

The partitions are back to original, including the sequence. IMEI and MAC addresses as per original.

I also saw that the partition table has changed totally, with partition1 start sector at 131072, which was after the initialization ROM end sector of 12693 (in my earlier post). Amazing how those have totally disappeared, and the first visible partition now starts at 131072.

The gpt_both0.bin file was taken from the ME571_eng package. And I had used parted to fix the partition table before using fastboot flash gpt. <-- This might be unique in my case.

Thanks again, the tablet is now back to perfect working condition.
[Nexus 7 (2013) Q&A] k23m:
Imei backup

Excellent, please do IMEI backup now - 'install' my script in TWRP and find IMEI-backup.tgz in the root of tablet's internal storage.

And then you can safely resume system partitions resizing because

N7'13 is now unbrickable!

:cool:

Actually, I propose collaboration with the author of Lanchon REPIT and inclusion of N7'13 in the tool. Can you do the "device-dump" script and ask for inclusion of our device?
[Nexus 7 (2013) Q&A] 459below:
I finally attempted to swap the eMMC. I successfully removed the old Kingston from the motherboard. In order to improve my abilities, before I try to solder the new eMMC chip to the mother board I tried soldering the old eMMC to the USB-eMMC device. After a skirmish involving a bloated soldering mat, a lot of solder bridges, desoldering wick and finally a torn out pad I decided to wait for my other USB-eMMC devices to arrive. I just hope that I haven't torn out any pads on the motherboard while cleaning with the wick.
[Nexus 7 (2013) Q&A] k23m:
I hope you can test out the USB-eMMC interface. Not for pre-programming, as this can now be easily done in-circuit, but for data recovery. I came across forum posts with people more concerned about lost data than their bricked device. There are many eMMC connection pads but only a few are actually active and relevant. In the worst case it is not over yet and one can resort to 'wiring' it... :cyclops:

Incidentally, if your original N7 was 16GB, you could now upgrade it to 32GB or even higher - it will work.
[Nexus 7 (2013) Q&A] 459below:
I was aware that not every pin is being used, however I did not know that it's that many. I want to clarify, that I tore out a pad for the USB connector on the cheap USB-eMMC device while I was trying to reconnect it. Afterwards I removed the eMMC again and discovered, that the eMMC wasn't properly connected anyway. The 5$ USB device is definitely rubbish now.

I consistently backup all my data automatically using solutions like Nextcloud, Davdroid, rsync and so on. So fortunately I did not lose any data at all and I can persue the data recovery effort as a purely academic exercise. I received the BGA169 stencil today, however I'm still awaiting the other USB-eMMC devices. I reckon I will be able to continue with this endeavour next weekend. After I have successfully connected the old eMMC to the USB-device, I will regard myself prepared for the actual repair.

I acquired a 64 GB eMMC indeed - namely Hynix H26M78003BFR. It complies with the eMMC 4.5 standard, which is fully supported by the APQ8064. I did read that eMMC 5 devices do work as well, since they have backwards compatibility capabilities.
[Nexus 7 (2013) Q&A] amix:
Hi, friends! I just swapped broken kingston to other emmc 5.0 chip, and nexus stuck after Google logo at loading screen on any firmware. Partitions are ok and i can use all 26Gb of memory from twrp( help me, please
[Nexus 7 (2013) Q&A] k23m:
No worries, boot in fastboot mode and run:

fastboot format userdata

fastboot format cache

fastboot format persist
​

Try Android now. If still no go, please post the output of the 2 commands...

fastboot getvar all

fastboot oem gpt-info
​
[Nexus 7 (2013) Q&A] k23m:
OK, let me explain the situation. When we re-uploaded the service ROM to an easily accessible server (thanks davefiddes), Jelly Bean 4.2.2 system image file was removed to decrease the download size, but Jelly Bean is great at raw eMMC presets and initialization. MM and custom ROMs can not handle empty 'persist' partition and just stop booting. No problem and we're not going to waste time downgrading to an ancient OS before flashing a modern one. Please boot TWRP, copy both attached files to the root of internal storage, 'install' p4-restore-int.zip and then reboot - Android will work now.

You might consider changing wifi and bt addresses later from the ones I made up, if you wish.

.bdaddr
D850E6444444

.macaddr
443835304536333633363336

BTW, I noticed from your log that it is a deb device. Unfortunately I can't help you restoring lost IMEI. You may be able to recover it from your broken Kingston. These partitions need to be copied.

/EDIT 2019

If you have used eMMC v5.1 chip, check this post for updated software.

:highfive:
[Nexus 7 (2013) Q&A] amix:
You are awesome! My Nexus is working now, imei is '0' and imei sv '00', but it doesn't matter for its use scenario. Thank you!
[Nexus 7 (2013) Q&A] Tmzdroid:
Thanks k23m although I haven't had any issues with my Kingston equipped Nexus 7 (Yet??) I've been following this thread and your work is brilliant. I hope I never have to use your instructions but it's good to know there is a fix.
[Nexus 7 (2013) Q&A] k23m:
It's been 2 years since our first chat about eMMC :highfive:

So Kingston is not a total disaster on N7 but if you have a deb model please backup IMEI now because without it the fix is not complete. Perhaps TWRP for deb has IMEI backup option too.
[Nexus 7 (2013) Q&A] Tmzdroid:
Thanks but it's a Flo still runs like a champ on stock 6.01 with Elemental X kernel although I'm tempted to flash a Nougat or Oreo rom or maybe multiboot? Then again "If it ain't broke don't try to fix it"
[Nexus 7 (2013) Q&A] davewpy:
I'm not sure how to ask for inclusion to lanchon, it's an old project that hasn't seen any commits for 2 years.

Manually backup my partitions using dd for now.

Anyway my touchscreen and sensors are all wonky, probably due to a broken cable inside.

Reseat all connections and still persist. Either the USB board, digitizer or cable is broken, not sure which is which.

Will have to fix that first! Arggh.
[Nexus 7 (2013) Q&A] 459below:
I gave it another go today, however I was not able to reball the Kingston eMMC. I did arrive at the conclusion, that I will need to upgrade my heat source from a cheap heat gun to a proper hot air station. I have to postpone this project another two weekends. I suppose good things come to those who wait... I hope so at least :)
[Nexus 7 (2013) Q&A] k23m:
While eMMC v5.1 is hardware-compatible with N7'13, it will not work on Android v5 and older because the kernel needs an update https://patchwork.kernel.org/patch/2596591/

This issue will concern those who insist on using Android v4.x for performance and other reasons. Also, I prefer a workaround for blank eMMC initialization instead of the ancient Jelly Bean in the unbricking guide because the original service ROM package would not work on modern eMMC v5.1.

Thanks again for testing the recovery method. I hope a faulty, read-only Kingston works in a USB adapter and user data, IMEI, etc. can be recovered.
[Nexus 7 (2013) Q&A] amix:
I can solder my old Kingston to usb-emmc, when it comes to me from ali.
[Nexus 7 (2013) Q&A] k23m:
Awesome, please do so!
[Nexus 7 (2013) Q&A] 459below:
I came to my senses and acquired a proper hot air station. Furthermore I have finally received the other USB-eMMC devices. Tomorrow I am going to launch another attempt in equpping my stricken N7 with a functioning eMMC, after I now learned to appreciate how delicate this task actually is. It may slow me down a bit, but it will not deter me.
[Nexus 7 (2013) Q&A] Dazmatic:
He's cleaning the pads with fresh solder and flux.

Be warned, I tried this with my old nexus, there was glue around the chip. I got add much off as I could but when removing, it was very difficult. Couldn't tell if it was the solder or glue holding it down. Turns out it was the solder and ended up ripping pads and ruining the board. Didn't get it hour enough basically, it's old lead free solder so may take a bit more heat than you think. Good luck!